[email protected] vulnerability

[MikeMcC399]

Issue

The following example directories report high severity vulnerabilities due to their transient dependency usage of [email protected]:

Check with npm audit:

• examples/config
• examples/start

Check with pnpm audit:

• examples/start-and-pnpm-workspaces/packages

yarn audit shows no issue, however Dependabot reports the vulnerability:

• examples/start-and-yarn-workspaces/packages

Background

• The GitHub Advisory CVE-2024-45296 advises in general to upgrade to [email protected]. If a custom regex pattern is not provided, then [email protected] adds backtracking protection as a mitigation path for versions >= 2.0.0, < 3.3.0.

• [email protected] is required by [email protected] (current latest version release Nov 1, 2022)

• [email protected] is required by [email protected] up to the current latest version [email protected] release Apr 25, 2024.

Issues are open (vercel/serve#811 & vercel/serve-handler#211) requesting remediation, however the corresponding repos have a low level of maintenance activity, so it can't be predicted if / when there might be release updates with vulnerabilities resolved.